In breve
- CVE-2022-46363 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.apache.cxf:cxf-core, cxf (apache).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 69.6% delle vulnerabilità.
- Correzione: aggiornare a 3.5.5, 3.4.10 o successiva.
| Package | Affected versions | Patched versions |
|---|
| org.apache.cxf:cxf-core Maven | ≥ 3.5.0, < 3.5.5< 3.4.10
| 3.5.53.4.10
|
| cxf | ≥ 3.5.0, < 3.5.5< 3.4.10
| 3.5.53.4.10
|
Description
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
NVD description
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free